ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.

Bernd Melchers discovered that PHP's embedded libmagic library incorrectly handled indirect offset values. An attacker could use this issue to cause PHP to consume resources or crash, resulting in a denial of service. (CVE-2014-1943)

It was discovered that PHP incorrectly handled certain values when using the imagecrop function. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code. This issue only affected Ubuntu 13.10. (CVE-2013-7226, CVE-2013-7327, CVE-2013-7328, CVE-2014-2020).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of PHP 5.5.x prior to 5.5.9 are exposed to the following issues related to the GD extension :

  - A heap-based buffer overflow error exists related to the functions 'gdImageCrop' and 'imagecrop' that could allow denial of service attacks and possibly arbitrary code execution. (CVE-2013-7226)

  - An error exists in the function 'gdImageCrop' related to return value checking that could lead to use of NULL pointers and denial of service attacks. (CVE-2013-7327)

 - Multiple integer signedness errors exist in the function 'gdImageCrop' that could allow denial of service attacks and information disclosure. (CVE-2013-7328)

 - A data type checking error exists that could allow information disclosure. (CVE-2014-2020)



According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.9.  It is, therefore, potentially affected by the following vulnerabilities related to the GD extension :

  - A heap-based buffer overflow error exists related to     the functions 'gdImageCrop' and 'imagecrop' that could     allow denial of service attacks and possibly arbitrary     code execution. (CVE-2013-7226) 

  - An error exists in the function 'gdImageCrop' related     to return value checking that could lead to use of     NULL pointers and denial of service attacks.
    (CVE-2013-7327)

  - Multiple integer signedness errors exist in the     function 'gdImageCrop' that could allow denial of     service attacks and information disclosure.
    (CVE-2013-7328)

  - A data type checking error exists that could allow     information disclosure. (CVE-2014-2020)

Note that this plugin does not attempt to exploit these issues, but instead relies only on PHP's self-reported version number.

ID	Name	Product	Family	Type	Severity
72799	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : php5 vulnerabilities (USN-2126-1)	Nessus	Ubuntu Local Security Checks	Local	medium
8125	PHP 5.5.x < 5.5.9 GD Extension Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		high
72511	PHP 5.5.x < 5.5.9 GD Extension Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2014-2020

high

Tenable Plugins

medium

high

medium